PatchTheCVECVE-2021-37151: CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the use
CVE-2021-37151 is a medium-severity flaw (CVSS 5.3) affecting identity. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brut
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.9% (top 42%) |
| CISA exploited list | No |
| Weakness | CWE-203 |
| Published | 2021-09-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-37151?
identity: upgrade to 21.11.133. Exact commands for each OS are on this page.
Is CVE-2021-37151 being exploited?
CVE-2021-37151 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-37151 affect?
CVE-2021-37151 affects identity. Severity is medium (CVSS 5.3). CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate bet
How urgent is CVE-2021-37151?
Priority 38/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-42340 HIGH 8.3 MITIGATE CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
- CVE-2024-42339 MEDIUM 4.3 MITIGATE CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-42338 MEDIUM 4.3 MITIGATE CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-42337 MEDIUM 4.3 MITIGATE CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2022-22700 MEDIUM 5.3 UPGRADE CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the respons